docs: STATUS/ROADMAP — only extension restructure remains outstanding

Post-v0.6.0 spot-check of the three 2026-05-04 architecture-review
specs (per CLAUDE.md rule #4) confirms:

- CLI restructure: shipped as Plan B Cycles 1+2 (b9bd152, 3dd1e1b,
  3759f6a, e69b347). Last gap (read-side refresh_groups_cache
  callers) closed in d717f0d. Done-criteria all met.
- Security polish: shipped as Stream A Cycle 1 (89090a8) plus
  follow-ups for start.sh fourth window (0c9387f) and recovery_qr.rs
  docs (229e483). All four phases done.
- Extension restructure: genuinely outstanding. vault.ts is 1037 LOC
  (criterion ~200); the five-module split has not happened; setup.ts
  still imports relicario-wasm directly; shared/state.ts still has
  any-typed StateHost; SW router helpers still duplicated; CLI parity
  gap (relicario status) still open. Effort estimate: L.

Removes the incorrect "subcommand reorganization, interactive TUI
mode" descriptor — the original CLI restructure spec is about file
structure, not TUI or renames. The TUI descriptor was a roadmap
mis-paraphrase, not a real outstanding item.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ROADMAP.md

@@ -14,14 +14,11 @@ See `CHANGELOG.md` for tagged-release detail and `STATUS.md` for the per-train c
 
 ## Up next
 
-All three are specced but have no implementation plan yet. Writing a plan is the first move on any of them.
+Per the 2026-05-30 post-v0.6.0 audit: of the three 2026-05-04 architecture-review specs, two are already shipped (CLI restructure = Plan B Cycles 1+2; security polish = Stream A Cycle 1). Only the third is genuinely outstanding:
 
-- **CLI restructure** — subcommand reorganization, interactive TUI mode
+- **Extension restructure** — `vault.ts` split (5 modules), setup.ts SW-abstraction routing, type-checked `shared/state.ts`, SW router-helper dedup, `relicario status` parity, plus P2 cleanups (inactivity timer / gitHost-on-expiry / debounced detector). Effort: **L (multi-day to multi-week)**.
-  Spec: `docs/superpowers/specs/2026-05-04-cli-restructure-design.md`
-- **Extension restructure** — bundle / message-routing cleanup
   Spec: `docs/superpowers/specs/2026-05-04-extension-restructure-design.md`
-- **Security polish** — follow-up hardening from the architecture review
+  Plan: not yet written — that's the next concrete move.
-  Spec: `docs/superpowers/specs/2026-05-04-security-polish-design.md`
 
 ## Medium-term
 

STATUS.md

@@ -5,7 +5,7 @@
 ## Version
 
 **Last release tagged:** v0.6.0 — rolled up Phase 2B, v0.5.1 Streams A/B/C, 1C-γ, Plan B refactor (Cycles 1+2), management-surfaces revamp, and the doc-structure redesign into one tag.
-**Active track:** picking the next initiative (CLI restructure / extension restructure / security polish all have specs, no plans yet)
+**Active track:** extension restructure planning (CLI restructure + security polish both confirmed shipped; only extension restructure is genuinely outstanding from the 2026-05-04 architecture-review specs)
 
 ## What landed on main since the v0.5.0 version bump
 
@@ -124,10 +124,20 @@ Plan: `docs/superpowers/plans/2026-05-30-doc-structure-redesign.md` (all 37 sub-
 
 ## Up next
 
-The "Up next" queue at v0.6.0 is the three 2026-05-04 architecture-review specs. Each is specced but has no implementation plan yet — writing a plan is the first move on any of them.
+Per the 2026-05-30 post-v0.6.0 audit of the three 2026-05-04 architecture-review specs:
 
-1. **CLI restructure** (spec `2026-05-04-cli-restructure-design.md`) — subcommand reorganization + interactive TUI mode.
+- **CLI restructure** (`2026-05-04-cli-restructure-design.md`) — *already shipped* as Plan B Cycles 1+2 (`b9bd152`, `3dd1e1b`, `3759f6a`, `e69b347`); the last gap (read-side `refresh_groups_cache` callers in list/get) closed in `d717f0d`. Done-criteria all met.
-2. **Extension restructure** (spec `2026-05-04-extension-restructure-design.md`) — bundle / message-routing cleanup.
+- **Security polish** (`2026-05-04-security-polish-design.md`) — *already shipped* as Stream A Cycle 1 (`89090a8`) plus follow-ups (`0c9387f` start.sh fourth window, `229e483` recovery_qr.rs docs). All four phases done.
-3. **Security polish** (spec `2026-05-04-security-polish-design.md`) — follow-up security hardening from the architecture review.
+- **Extension restructure** (`2026-05-04-extension-restructure-design.md`) — **the only genuinely outstanding spec.** Spot-checks confirm:
+  - `extension/src/vault/vault.ts` is 1037 LOC (spec criterion: ~200; the split into `vault-shell.ts` / `vault-sidebar.ts` / `vault-list.ts` / `vault-drawer.ts` / `vault-form-wrapper.ts` / `vault-status.ts` has not happened)
+  - `extension/src/setup/setup.ts` still imports `relicario-wasm` directly (the SW-abstraction-bypass that P1.4 calls out)
+  - `extension/src/shared/state.ts` still has `any`-typed `StateHost`
+  - `loadDeviceSettings` / `loadBlacklist` / `saveBlacklist` / `itemToManifestEntry` still duplicated across `popup-only.ts` and `content-callable.ts`
+  - `relicario status` parity gap (no vault-tab equivalent of ahead/behind/lastSyncAt) still open
+  - Effort estimate from spec: **L (multi-day to multi-week)**
+
+The next concrete move is **writing an implementation plan** for the extension restructure spec.
+
+Beyond extension restructure, ROADMAP medium-term holds Phase 4 command palette (no spec yet). Long-term: relay server, mobile.
 
 See `ROADMAP.md` for the longer arc and `CHANGELOG.md` for tagged-release history (current head: `v0.5.0` entry, dated 2026-05-02 — predates the v0.5.1 train work and will be revised when the next tag cuts).